Data caching for cloud services

ABSTRACT

Methods and systems for caching data for resources using a shared cache are described herein. The data may be stored in a configuration service, in the resources, or in the shared cache. The data stored in the configuration service may be modified. The data stored in the resources and in the shared cache may be updated according to the modified data in the configuration service. The data stored in the configuration service, in the resources, or in the shared cache may be used based on an operation mode.

FIELD

Aspects described herein generally relate to computer and networkhardware and software. In particular, the present disclosure relates tomethods and systems for caching data for resources using a shared cachein a cloud system.

BACKGROUND

Enterprises are increasingly adopting cloud computing services, as wellas new approaches to data storage including object storage. Cloudcomputing services may provide various resources as a service to users.Data used for or by the resources may be stored in databases running onthe cloud computing servers. When the data are needed for or by theresources, requests to obtain the data may be sent to the databasesrunning on the cloud computing servers. As the number of users accessingthe resources increases rapidly, architecture for handling a voluminousnumber of requests to obtain the data may be developed.

SUMMARY

The following presents a simplified summary of various aspects describedherein. This summary is not an extensive overview, and is not intendedto identify required or critical elements or to delineate the scope ofthe claims. The following summary merely presents some concepts in asimplified form as an introductory prelude to the more detaileddescription provided below.

Examples described herein are directed towards a system, an apparatus,and/or computer readable media configured to perform a method forcaching data for resources using a shared cache. The method may includereceiving, from a user device and by a computing device, a request toaccess a resource. The computing device may determine an identifierassociated with the resource and a data identifier indicating first dataassociated with the resource. The first data may be stored in theresource. The computing device may determine, based on informationindicating a load of a configuration service, an operation mode. Afterdetermining that the operation mode comprises a high load operationmode, the computing device may send, to the shared cache, a request todetermine whether second data associated with the resource is stored inthe shared cache. The request to determine whether the second dataassociated with the resource is stored in the shared cache may comprisethe identifier associated with the resource and the data identifier. Thecomputing device may receive, from the shared cache, an indication ofwhether the second data associated with the resource is stored in theshared cache. The computing device may determine, based on theindication of whether the second data associated with the resource isstored in the shared cache, whether to send, to the configurationservice, a request to obtain third data associated with the resource.

In some examples, the computing device may determine, based on the dataidentifier, whether the second data is different from the first data.After determining that the second data is different from the first data,the computing device may replace the first data with the second data. Insome examples, the computing device may receive an indication that thesecond data corresponds to the first data. The computing device maylaunch the resource based on the first data.

In some examples, the second data may expire after an expiration period.After determining that the operation mode comprises the high loadoperation mode, the computing device may refresh the expiration periodof the second data. In some examples, after determining that the seconddata is not stored in the shared cache, the computing device may send,to the configuration service, a request to obtain the third data. Thecomputing device may receive, from the configuration service, the thirddata. The computing device may insert, to the shared cache, the thirddata.

In some examples, the computing device may receive a second request toaccess a second resource. After determining that a second operation modecomprises a low load operation mode, the computing device may send, tothe configuration service, a request to obtain fourth data associatedwith the second resource. In some examples, the determining theoperation mode may comprise determining the operation mode based onbusiness hours of a business associated with a user of the user device.

In some examples, the computing device may receive, within a period oftime, a plurality of requests to access a plurality of resources. Thedetermining the operation mode may comprise determining the operationmode based on a number, of the plurality of requests, exceeding athreshold. In some examples, the shared cache may comprise an in-memorydatabase. In some examples, the data identifier may comprise afingerprint of the first data.

These and additional aspects will be appreciated with the benefit of thedisclosures discussed in further detail below.

BRIEF DESCRIPTION OF THE DRAWINGS

A more complete understanding of aspects described herein and theadvantages thereof may be acquired by referring to the followingdescription in consideration of the accompanying drawings, in which likereference numbers indicate like features, and wherein:

FIG. 1 depicts an illustrative computer system architecture that may beused in accordance with one or more illustrative aspects describedherein.

FIG. 2 depicts an illustrative remote-access system architecture thatmay be used in accordance with one or more illustrative aspectsdescribed herein.

FIG. 3 depicts an illustrative virtualized (hypervisor) systemarchitecture that may be used in accordance with one or moreillustrative aspects described herein.

FIG. 4 depicts an illustrative cloud-based system architecture that maybe used in accordance with one or more illustrative aspects describedherein.

FIG. 5 is a schematic diagram showing an example system for caching datain a cloud system.

FIG. 6 is a flowchart showing an example method for caching data using ashared cache.

FIG. 7 is a flowchart showing an example method for updating orrefreshing data stored in a shared cache.

FIG. 8 is a flowchart showing an example method for updating data storedin a shared cache based on data change events.

DETAILED DESCRIPTION

In the following description of the various embodiments, reference ismade to the accompanying drawings identified above and which form a parthereof, and in which is shown by way of illustration various embodimentsin which aspects described herein may be practiced. It is to beunderstood that other embodiments may be utilized and structural andfunctional modifications may be made without departing from the scopedescribed herein. Various aspects are capable of other embodiments andof being practiced or being carried out in various different ways.

As a general introduction to the subject matter described in more detailbelow, aspects described herein are directed towards caching data forresources using a shared cache. A user may request to access a resourcefor his or her various uses. Data associated with the resource may bestored in a configuration service, the resource, or the shared cache.The data stored in the configuration service may be modified. The datastored in the resource and in the shared cache may be updated based onthe modified data in the configuration service. The data stored in theconfiguration service, the resource, or the shared cache may be usedbased on an operation mode.

It is to be understood that the phraseology and terminology used hereinare for the purpose of description and should not be regarded aslimiting. Rather, the phrases and terms used herein are to be giventheir broadest interpretation and meaning. The use of “including” and“comprising” and variations thereof is meant to encompass the itemslisted thereafter and equivalents thereof as well as additional itemsand equivalents thereof. The use of the terms “mounted,” “connected,”“coupled,” “positioned,” “engaged” and similar terms, is meant toinclude both direct and indirect mounting, connecting, coupling,positioning and engaging.

Computing Architecture

Computer software, hardware, and networks may be utilized in a varietyof different system environments, including standalone, networked,remote-access (also known as remote desktop), virtualized, and/orcloud-based environments, among others. FIG. 1 illustrates one exampleof a system architecture and data processing device that may be used toimplement one or more illustrative aspects described herein in astandalone and/or networked environment. Various network nodes 103, 105,107, and 109 may be interconnected via a wide area network (WAN) 101,such as the Internet. Other networks may also or alternatively be used,including private intranets, corporate networks, local area networks(LAN), metropolitan area networks (MAN), wireless networks, personalnetworks (PAN), and the like. Network 101 is for illustration purposesand may be replaced with fewer or additional computer networks. A localarea network 133 may have one or more of any known LAN topology and mayuse one or more of a variety of different protocols, such as Ethernet.Devices 103, 105, 107, and 109 and other devices (not shown) may beconnected to one or more of the networks via twisted pair wires, coaxialcable, fiber optics, radio waves, or other communication media.

The term “network” as used herein and depicted in the drawings refersnot only to systems in which remote storage devices are coupled togethervia one or more communication paths, but also to stand-alone devicesthat may be coupled, from time to time, to such systems that havestorage capability. Consequently, the term “network” includes not only a“physical network” but also a “content network,” which is comprised ofthe data—attributable to a single entity—which resides across allphysical networks.

The components may include data server 103, web server 105, and clientcomputers 107, 109. Data server 103 provides overall access, control andadministration of databases and control software for performing one ormore illustrative aspects describe herein. Data server 103 may beconnected to web server 105 through which users interact with and obtaindata as requested. Alternatively, data server 103 may act as a webserver itself and be directly connected to the Internet. Data server 103may be connected to web server 105 through the local area network 133,the wide area network 101 (e.g., the Internet), via direct or indirectconnection, or via some other network. Users may interact with the dataserver 103 using remote computers 107, 109, e.g., using a web browser toconnect to the data server 103 via one or more externally exposed websites hosted by web server 105. Client computers 107, 109 may be used inconcert with data server 103 to access data stored therein, or may beused for other purposes. For example, from client device 107 a user mayaccess web server 105 using an Internet browser, as is known in the art,or by executing a software application that communicates with web server105 and/or data server 103 over a computer network (such as theInternet).

Servers and applications may be combined on the same physical machines,and retain separate virtual or logical addresses, or may reside onseparate physical machines. FIG. 1 illustrates just one example of anetwork architecture that may be used, and those of skill in the artwill appreciate that the specific network architecture and dataprocessing devices used may vary, and are secondary to the functionalitythat they provide, as further described herein. For example, servicesprovided by web server 105 and data server 103 may be combined on asingle server.

Each component 103, 105, 107, 109 may be any type of known computer,server, or data processing device. Data server 103, e.g., may include aprocessor 111 controlling overall operation of the data server 103. Dataserver 103 may further include random access memory (RAM) 113, read onlymemory (ROM) 115, network interface 117, input/output interfaces 119(e.g., keyboard, mouse, display, printer, etc.), and memory 121.Input/output (I/O) 119 may include a variety of interface units anddrives for reading, writing, displaying, and/or printing data or files.Memory 121 may further store operating system software 123 forcontrolling overall operation of the data processing device 103, controllogic 125 for instructing data server 103 to perform aspects describedherein, and other application software 127 providing secondary, support,and/or other functionality which may or might not be used in conjunctionwith aspects described herein. The control logic may also be referred toherein as the data server software 125. Functionality of the data serversoftware may refer to operations or decisions made automatically basedon rules coded into the control logic, made manually by a user providinginput into the system, and/or a combination of automatic processingbased on user input (e.g., queries, data updates, etc.).

Memory 121 may also store data used in performance of one or moreaspects described herein, including a first database 129 and a seconddatabase 131. In some embodiments, the first database may include thesecond database (e.g., as a separate table, report, etc.). That is, theinformation can be stored in a single database, or separated intodifferent logical, virtual, or physical databases, depending on systemdesign. Devices 105, 107, and 109 may have similar or differentarchitecture as described with respect to device 103. Those of skill inthe art will appreciate that the functionality of data processing device103 (or device 105, 107, or 109) as described herein may be spreadacross multiple data processing devices, for example, to distributeprocessing load across multiple computers, to segregate transactionsbased on geographic location, user access level, quality of service(QoS), etc.

One or more aspects may be embodied in computer-usable or readable dataand/or computer-executable instructions, such as in one or more programmodules, executed by one or more computers or other devices as describedherein. Generally, program modules include routines, programs, objects,components, data structures, etc. that perform particular tasks orimplement particular abstract data types when executed by a processor ina computer or other device. The modules may be written in a source codeprogramming language that is subsequently compiled for execution, or maybe written in a scripting language such as (but not limited to)HyperText Markup Language (HTML) or Extensible Markup Language (XML).The computer executable instructions may be stored on a computerreadable medium such as a nonvolatile storage device. Any suitablecomputer readable storage media may be utilized, including hard disks,CD-ROMs, optical storage devices, magnetic storage devices, and/or anycombination thereof. In addition, various transmission (non-storage)media representing data or events as described herein may be transferredbetween a source and a destination in the form of electromagnetic wavestraveling through signal-conducting media such as metal wires, opticalfibers, and/or wireless transmission media (e.g., air and/or space).Various aspects described herein may be embodied as a method, a dataprocessing system, or a computer program product. Therefore, variousfunctionalities may be embodied in whole or in part in software,firmware, and/or hardware or hardware equivalents such as integratedcircuits, field programmable gate arrays (FPGA), and the like.Particular data structures may be used to more effectively implement oneor more aspects described herein, and such data structures arecontemplated within the scope of computer executable instructions andcomputer-usable data described herein.

With further reference to FIG. 2, one or more aspects described hereinmay be implemented in a remote-access environment. FIG. 2 depicts anexample system architecture including a computing device 201 in anillustrative computing environment 200 that may be used according to oneor more illustrative aspects described herein. Computing device 201 maybe used as a server 206 a in a single-server or multi-server desktopvirtualization system (e.g., a remote access or cloud system) configuredto provide virtual machines for client access devices. The computingdevice 201 may have a processor 203 for controlling overall operation ofthe server and its associated components, including RAM 205, ROM 207,Input/Output (I/O) module 209, and memory 215.

I/O module 209 may include a mouse, keypad, touch screen, scanner,optical reader, and/or stylus (or other input device(s)) through which auser of computing device 201 may provide input, and may also include oneor more of a speaker for providing audio output and one or more of avideo display device for providing textual, audiovisual, and/orgraphical output. Software may be stored within memory 215 and/or otherstorage to provide instructions to processor 203 for configuringcomputing device 201 into a special purpose computing device in order toperform various functions as described herein. For example, memory 215may store software used by the computing device 201, such as anoperating system 217, application programs 219, and an associateddatabase 221.

Computing device 201 may operate in a networked environment supportingconnections to one or more remote computers, such as terminals 240 (alsoreferred to as client devices). The terminals 240 may be personalcomputers, mobile devices, laptop computers, tablets, or servers thatinclude many or all of the elements described above with respect to thecomputing device 103 or 201. The network connections depicted in FIG. 2include a local area network (LAN) 225 and a wide area network (WAN)229, but may also include other networks. When used in a LAN networkingenvironment, computing device 201 may be connected to the LAN 225through a network interface or adapter 223. When used in a WANnetworking environment, computing device 201 may include a modem 227 orother wide area network interface for establishing communications overthe WAN 229, such as computer network 230 (e.g., the Internet). It willbe appreciated that the network connections shown are illustrative andother means of establishing a communications link between the computersmay be used. Computing device 201 and/or terminals 240 may also bemobile terminals (e.g., mobile phones, smartphones, personal digitalassistants (PDAs), notebooks, etc.) including various other components,such as a battery, speaker, and antennas (not shown).

Aspects described herein may also be operational with numerous othergeneral purpose or special purpose computing system environments orconfigurations. Examples of other computing systems, environments,and/or configurations that may be suitable for use with aspectsdescribed herein include, but are not limited to, personal computers,server computers, hand-held or laptop devices, multiprocessor systems,microprocessor-based systems, set top boxes, programmable consumerelectronics, network personal computers (PCs), minicomputers, mainframecomputers, distributed computing environments that include any of theabove systems or devices, and the like.

As shown in FIG. 2, one or more client devices 240 may be incommunication with one or more servers 206 a-206 n (generally referredto herein as “server(s) 206”). In one embodiment, the computingenvironment 200 may include a network appliance installed between theserver(s) 206 and client machine(s) 240. The network appliance maymanage client/server connections, and in some cases can load balanceclient connections amongst a plurality of backend servers 206.

The client machine(s) 240 may in some embodiments be referred to as asingle client machine 240 or a single group of client machines 240,while server(s) 206 may be referred to as a single server 206 or asingle group of servers 206. In one embodiment a single client machine240 communicates with more than one server 206, while in anotherembodiment a single server 206 communicates with more than one clientmachine 240. In yet another embodiment, a single client machine 240communicates with a single server 206.

A client machine 240 can, in some embodiments, be referenced by any oneof the following non-exhaustive terms: client machine(s); client(s);client computer(s); client device(s); client computing device(s); localmachine; remote machine; client node(s); endpoint(s); or endpointnode(s). The server 206, in some embodiments, may be referenced by anyone of the following non-exhaustive terms: server(s), local machine;remote machine; server farm(s), or host computing device(s).

In one embodiment, the client machine 240 may be a virtual machine. Thevirtual machine may be any virtual machine, while in some embodimentsthe virtual machine may be any virtual machine managed by a Type 1 orType 2 hypervisor, for example, a hypervisor developed by CitrixSystems, IBM, VMware, or any other hypervisor. In some aspects, thevirtual machine may be managed by a hypervisor, while in other aspectsthe virtual machine may be managed by a hypervisor executing on a server206 or a hypervisor executing on a client 240.

Some embodiments include a client device 240 that displays applicationoutput generated by an application remotely executing on a server 206 orother remotely located machine. In these embodiments, the client device240 may execute a virtual machine receiver program or application todisplay the output in an application window, a browser, or other outputwindow. In one example, the application is a desktop, while in otherexamples the application is an application that generates or presents adesktop. A desktop may include a graphical shell providing a userinterface for an instance of an operating system in which local and/orremote applications can be integrated. Applications, as used herein, areprograms that execute after an instance of an operating system (and,optionally, also the desktop) has been loaded.

The server 206, in some embodiments, uses a remote presentation protocolor other program to send data to a thin-client or remote-displayapplication executing on the client to present display output generatedby an application executing on the server 206. The thin-client orremote-display protocol can be any one of the following non-exhaustivelist of protocols: the Independent Computing Architecture (ICA) protocoldeveloped by Citrix Systems, Inc. of Ft. Lauderdale, Fla.; or the RemoteDesktop Protocol (RDP) manufactured by the Microsoft Corporation ofRedmond, Wash.

A remote computing environment may include more than one server 206a-206 n such that the servers 206 a-206 n are logically grouped togetherinto a server farm 206, for example, in a cloud computing environment.The server farm 206 may include servers 206 that are geographicallydispersed while and logically grouped together, or servers 206 that arelocated proximate to each other while logically grouped together.Geographically dispersed servers 206 a-206 n within a server farm 206can, in some embodiments, communicate using a WAN (wide), MAN(metropolitan), or LAN (local), where different geographic regions canbe characterized as: different continents; different regions of acontinent; different countries; different states; different cities;different campuses; different rooms; or any combination of the precedinggeographical locations. In some embodiments the server farm 206 may beadministered as a single entity, while in other embodiments the serverfarm 206 can include multiple server farms.

In some embodiments, a server farm may include servers 206 that executea substantially similar type of operating system platform (e.g.,WINDOWS, UNIX, LINUX, iOS, ANDROID, SYMBIAN, etc.) In other embodiments,server farm 206 may include a first group of one or more servers thatexecute a first type of operating system platform, and a second group ofone or more servers that execute a second type of operating systemplatform.

Server 206 may be configured as any type of server, as needed, e.g., afile server, an application server, a web server, a proxy server, anappliance, a network appliance, a gateway, an application gateway, agateway server, a virtualization server, a deployment server, a SecureSockets Layer (SSL) VPN server, a firewall, a web server, an applicationserver or as a master application server, a server executing an activedirectory, or a server executing an application acceleration programthat provides firewall functionality, application functionality, or loadbalancing functionality. Other server types may also be used.

Some embodiments include a first server 206 a that receives requestsfrom a client machine 240, forwards the request to a second server 206 b(not shown), and responds to the request generated by the client machine240 with a response from the second server 206 b (not shown.) Firstserver 206 a may acquire an enumeration of applications available to theclient machine 240 and well as address information associated with anapplication server 206 hosting an application identified within theenumeration of applications. First server 206 a can then present aresponse to the client's request using a web interface, and communicatedirectly with the client 240 to provide the client 240 with access to anidentified application. One or more clients 240 and/or one or moreservers 206 may transmit data over network 230, e.g., network 101.

FIG. 3 shows a high-level architecture of an illustrative desktopvirtualization system. As shown, the desktop virtualization system maybe single-server or multi-server system, or cloud system, including atleast one virtualization server 301 configured to provide virtualdesktops and/or virtual applications to one or more client accessdevices 240. As used herein, a desktop refers to a graphical environmentor space in which one or more applications may be hosted and/orexecuted. A desktop may include a graphical shell providing a userinterface for an instance of an operating system in which local and/orremote applications can be integrated. Applications may include programsthat execute after an instance of an operating system (and, optionally,also the desktop) has been loaded. Each instance of the operating systemmay be physical (e.g., one operating system per device) or virtual(e.g., many instances of an OS running on a single device). Eachapplication may be executed on a local device, or executed on a remotelylocated device (e.g., remoted).

A computer device 301 may be configured as a virtualization server in avirtualization environment, for example, a single-server, multi-server,or cloud computing environment. Virtualization server 301 illustrated inFIG. 3 can be deployed as and/or implemented by one or more embodimentsof the server 206 illustrated in FIG. 2 or by other known computingdevices. Included in virtualization server 301 is a hardware layer thatcan include one or more physical disks 304, one or more physical devices306, one or more physical processors 308, and one or more physicalmemories 316. In some embodiments, firmware 312 can be stored within amemory element in the physical memory 316 and can be executed by one ormore of the physical processors 308. Virtualization server 301 mayfurther include an operating system 314 that may be stored in a memoryelement in the physical memory 316 and executed by one or more of thephysical processors 308. Still further, a hypervisor 302 may be storedin a memory element in the physical memory 316 and can be executed byone or more of the physical processors 308.

Executing on one or more of the physical processors 308 may be one ormore virtual machines 332A-C (generally 332). Each virtual machine 332may have a virtual disk 326A-C and a virtual processor 328A-C. In someembodiments, a first virtual machine 332A may execute, using a virtualprocessor 328A, a control program 320 that includes a tools stack 324.Control program 320 may be referred to as a control virtual machine,Dom0, Domain 0, or other virtual machine used for system administrationand/or control. In some embodiments, one or more virtual machines 332B-Ccan execute, using a virtual processor 328B-C, a guest operating system330A-B.

Virtualization server 301 may include a hardware layer 310 with one ormore pieces of hardware that communicate with the virtualization server301. In some embodiments, the hardware layer 310 can include one or morephysical disks 304, one or more physical devices 306, one or morephysical processors 308, and one or more physical memory 316. Physicalcomponents 304, 306, 308, and 316 may include, for example, any of thecomponents described above. Physical devices 306 may include, forexample, a network interface card, a video card, a keyboard, a mouse, aninput device, a monitor, a display device, speakers, an optical drive, astorage device, a universal serial bus connection, a printer, a scanner,a network element (e.g., router, firewall, network address translator,load balancer, virtual private network (VPN) gateway, Dynamic HostConfiguration Protocol (DHCP) router, etc.), or any device connected toor communicating with virtualization server 301. Physical memory 316 inthe hardware layer 310 may include any type of memory. Physical memory316 may store data, and in some embodiments may store one or moreprograms, or set of executable instructions. FIG. 3 illustrates anembodiment where firmware 312 is stored within the physical memory 316of virtualization server 301. Programs or executable instructions storedin the physical memory 316 can be executed by the one or more processors308 of virtualization server 301.

Virtualization server 301 may also include a hypervisor 302. In someembodiments, hypervisor 302 may be a program executed by processors 308on virtualization server 301 to create and manage any number of virtualmachines 332. Hypervisor 302 may be referred to as a virtual machinemonitor, or platform virtualization software. In some embodiments,hypervisor 302 can be any combination of executable instructions andhardware that monitors virtual machines executing on a computingmachine. Hypervisor 302 may be Type 2 hypervisor, where the hypervisorexecutes within an operating system 314 executing on the virtualizationserver 301. Virtual machines may then execute at a level above thehypervisor. In some embodiments, the Type 2 hypervisor may executewithin the context of a user's operating system such that the Type 2hypervisor interacts with the user's operating system. In otherembodiments, one or more virtualization servers 301 in a virtualizationenvironment may instead include a Type 1 hypervisor (not shown). A Type1 hypervisor may execute on the virtualization server 301 by directlyaccessing the hardware and resources within the hardware layer 310. Thatis, while a Type 2 hypervisor 302 accesses system resources through ahost operating system 314, as shown, a Type 1 hypervisor may directlyaccess all system resources without the host operating system 314. AType 1 hypervisor may execute directly on one or more physicalprocessors 308 of virtualization server 301, and may include programdata stored in the physical memory 316.

Hypervisor 302, in some embodiments, can provide virtual resources tooperating systems 330 or control programs 320 executing on virtualmachines 332 in any manner that simulates the operating systems 330 orcontrol programs 320 having direct access to system resources. Systemresources can include, but are not limited to, physical devices 306,physical disks 304, physical processors 308, physical memory 316, andany other component included in virtualization server 301 hardware layer310. Hypervisor 302 may be used to emulate virtual hardware, partitionphysical hardware, virtualize physical hardware, and/or execute virtualmachines that provide access to computing environments. In still otherembodiments, hypervisor 302 may control processor scheduling and memorypartitioning for a virtual machine 332 executing on virtualizationserver 301. Hypervisor 302 may include those manufactured by VMWare,Inc., of Palo Alto, Calif.; the XENPROJECT hypervisor, an open sourceproduct whose development is overseen by the open source XenProject.orgcommunity; HyperV, VirtualServer or virtual PC hypervisors provided byMicrosoft, or others. In some embodiments, virtualization server 301 mayexecute a hypervisor 302 that creates a virtual machine platform onwhich guest operating systems may execute. In these embodiments, thevirtualization server 301 may be referred to as a host server. Anexample of such a virtualization server is the XENSERVER provided byCitrix Systems, Inc., of Fort Lauderdale, Fla.

Hypervisor 302 may create one or more virtual machines 332B-C (generally332) in which guest operating systems 330 execute. In some embodiments,hypervisor 302 may load a virtual machine image to create a virtualmachine 332. In other embodiments, the hypervisor 302 may execute aguest operating system 330 within virtual machine 332. In still otherembodiments, virtual machine 332 may execute guest operating system 330.

In addition to creating virtual machines 332, hypervisor 302 may controlthe execution of at least one virtual machine 332. In other embodiments,hypervisor 302 may present at least one virtual machine 332 with anabstraction of at least one hardware resource provided by thevirtualization server 301 (e.g., any hardware resource available withinthe hardware layer 310). In other embodiments, hypervisor 302 maycontrol the manner in which virtual machines 332 access physicalprocessors 308 available in virtualization server 301. Controllingaccess to physical processors 308 may include determining whether avirtual machine 332 should have access to a processor 308, and howphysical processor capabilities are presented to the virtual machine332.

As shown in FIG. 3, virtualization server 301 may host or execute one ormore virtual machines 332. A virtual machine 332 is a set of executableinstructions that, when executed by a processor 308, may imitate theoperation of a physical computer such that the virtual machine 332 canexecute programs and processes much like a physical computing device.While FIG. 3 illustrates an embodiment where a virtualization server 301hosts three virtual machines 332, in other embodiments virtualizationserver 301 can host any number of virtual machines 332. Hypervisor 302,in some embodiments, may provide each virtual machine 332 with a uniquevirtual view of the physical hardware, memory, processor, and othersystem resources available to that virtual machine 332. In someembodiments, the unique virtual view can be based on one or more ofvirtual machine permissions, application of a policy engine to one ormore virtual machine identifiers, a user accessing a virtual machine,the applications executing on a virtual machine, networks accessed by avirtual machine, or any other desired criteria. For instance, hypervisor302 may create one or more unsecure virtual machines 332 and one or moresecure virtual machines 332. Unsecure virtual machines 332 may beprevented from accessing resources, hardware, memory locations, andprograms that secure virtual machines 332 may be permitted to access. Inother embodiments, hypervisor 302 may provide each virtual machine 332with a substantially similar virtual view of the physical hardware,memory, processor, and other system resources available to the virtualmachines 332.

Each virtual machine 332 may include a virtual disk 326A-C (generally326) and a virtual processor 328A-C (generally 328.) The virtual disk326, in some embodiments, is a virtualized view of one or more physicaldisks 304 of the virtualization server 301, or a portion of one or morephysical disks 304 of the virtualization server 301. The virtualizedview of the physical disks 304 can be generated, provided, and managedby the hypervisor 302. In some embodiments, hypervisor 302 provides eachvirtual machine 332 with a unique view of the physical disks 304. Thus,in these embodiments, the particular virtual disk 326 included in eachvirtual machine 332 can be unique when compared with the other virtualdisks 326.

A virtual processor 328 can be a virtualized view of one or morephysical processors 308 of the virtualization server 301. In someembodiments, the virtualized view of the physical processors 308 can begenerated, provided, and managed by hypervisor 302. In some embodiments,virtual processor 328 has substantially all of the same characteristicsof at least one physical processor 308. In other embodiments, virtualprocessor 308 provides a modified view of physical processors 308 suchthat at least some of the characteristics of the virtual processor 328are different than the characteristics of the corresponding physicalprocessor 308.

With further reference to FIG. 4, some aspects described herein may beimplemented in a cloud-based environment. FIG. 4 illustrates an exampleof a cloud computing environment (or cloud system) 400. As seen in FIG.4, client computers 411-414 may communicate with a cloud managementserver 410 to access the computing resources (e.g., host servers 403a-403 b (generally referred herein as “host servers 403”), storageresources 404 a-404 b (generally referred herein as “storage resources404”), and network resources 405 a-405 b (generally referred herein as“network resources 405”)) of the cloud system.

Management server 410 may be implemented on one or more physicalservers. The management server 410 may run, for example, CLOUDPLATFORMby Citrix Systems, Inc. of Ft. Lauderdale, Fla., or OPENSTACK, amongothers. Management server 410 may manage various computing resources,including cloud hardware and software resources, for example, hostcomputers 403, data storage devices 404, and networking devices 405. Thecloud hardware and software resources may include private and/or publiccomponents. For example, a cloud may be configured as a private cloud tobe used by one or more particular customers or client computers 411-414and/or over a private network. In other embodiments, public clouds orhybrid public-private clouds may be used by other customers over an openor hybrid networks.

Management server 410 may be configured to provide user interfacesthrough which cloud operators and cloud customers may interact with thecloud system 400. For example, the management server 410 may provide aset of application programming interfaces (APIs) and/or one or morecloud operator console applications (e.g., web-based or standaloneapplications) with user interfaces to allow cloud operators to managethe cloud resources, configure the virtualization layer, manage customeraccounts, and perform other cloud administration tasks. The managementserver 410 also may include a set of APIs and/or one or more customerconsole applications with user interfaces configured to receive cloudcomputing requests from end users via client computers 411-414, forexample, requests to create, modify, or destroy virtual machines withinthe cloud. Client computers 411-414 may connect to management server 410via the Internet or some other communication network, and may requestaccess to one or more of the computing resources managed by managementserver 410. In response to client requests, the management server 410may include a resource manager configured to select and provisionphysical resources in the hardware layer of the cloud system based onthe client requests. For example, the management server 410 andadditional components of the cloud system may be configured toprovision, create, and manage virtual machines and their operatingenvironments (e.g., hypervisors, storage resources, services offered bythe network elements, etc.) for customers at client computers 411-414,over a network (e.g., the Internet), providing customers withcomputational resources, data storage services, networking capabilities,and computer platform and application support. Cloud systems also may beconfigured to provide various specific services, including securitysystems, development environments, user interfaces, and the like.

Certain clients 411-414 may be related, for example, different clientcomputers creating virtual machines on behalf of the same end user, ordifferent users affiliated with the same company or organization. Inother examples, certain clients 411-414 may be unrelated, such as usersaffiliated with different companies or organizations. For unrelatedclients, information on the virtual machines or storage of any one usermay be hidden from other users.

Referring now to the physical hardware layer of a cloud computingenvironment, availability zones 401-402 (or zones) may refer to acollocated set of physical computing resources. Zones may begeographically separated from other zones in the overall cloud ofcomputing resources. For example, zone 401 may be a first clouddatacenter located in California, and zone 402 may be a second clouddatacenter located in Florida. Management server 410 may be located atone of the availability zones, or at a separate location. Each zone mayinclude an internal network that interfaces with devices that areoutside of the zone, such as the management server 410, through agateway. End users of the cloud (e.g., clients 411-414) might or mightnot be aware of the distinctions between zones. For example, an end usermay request the creation of a virtual machine having a specified amountof memory, processing power, and network capabilities. The managementserver 410 may respond to the user's request and may allocate theresources to create the virtual machine without the user knowing whetherthe virtual machine was created using resources from zone 401 or zone402. In other examples, the cloud system may allow end users to requestthat virtual machines (or other cloud resources) are allocated in aspecific zone or on specific resources 403-405 within a zone.

In this example, each zone 401-402 may include an arrangement of variousphysical hardware components (or computing resources) 403-405, forexample, physical hosting resources (or processing resources), physicalnetwork resources, physical storage resources, switches, and additionalhardware resources that may be used to provide cloud computing servicesto customers. The physical hosting resources in a cloud zone 401-402 mayinclude one or more computer servers 403, such as the virtualizationservers 301 described above, which may be configured to create and hostvirtual machine instances. The physical network resources in a cloudzone 401 or 402 may include one or more network elements 405 (e.g.,network service providers) comprising hardware and/or softwareconfigured to provide a network service to cloud customers, such asfirewalls, network address translators, load balancers, virtual privatenetwork (VPN) gateways, Dynamic Host Configuration Protocol (DHCP)routers, and the like. The storage resources in the cloud zone 401-402may include storage disks (e.g., solid state drives (SSDs), magnetichard disks, etc.) and other storage devices.

The example cloud computing environment shown in FIG. 4 also may includea virtualization layer (e.g., as shown in FIGS. 1-3) with additionalhardware and/or software resources configured to create and managevirtual machines and provide other services to customers using thephysical resources in the cloud. The virtualization layer may includehypervisors, as described above in FIG. 3, along with other componentsto provide network virtualizations, storage virtualizations, etc. Thevirtualization layer may be as a separate layer from the physicalresource layer, or may share some or all of the same hardware and/orsoftware resources with the physical resource layer. For example, thevirtualization layer may include a hypervisor installed in each of thevirtualization servers 403 with the physical computing resources. Knowncloud systems may alternatively be used, e.g., WINDOWS AZURE (MicrosoftCorporation of Redmond Wash.), AMAZON EC2 (Amazon.com Inc. of Seattle,Wash.), IBM BLUE CLOUD (IBM Corporation of Armonk, N.Y.), or others.

Data Caching for Cloud Services

FIG. 5 is a schematic diagram showing an example system for caching datain a cloud system. The system may comprise one or more remote computingdevices (e.g., remote computing devices 501A, 501B), a cloud service503, and an internal cloud 505. The remote computing devices 501A, 501B,the cloud service 503, and the internal cloud 505 may communicate witheach other via a network (e.g., the wide area network 101, the computernetwork 230, the Internet, or other networks).

The remote computing devices 501A, 501B may comprise, for example, theclient computers 107, 109, the client devices 240, the client computers411-414, or other computing devices. A client agent 507 may beimplemented on the remote computing device 501A. A user agent 509 may beimplemented on the remote computing device 501B.

The cloud service 503 may comprise processes implemented on, forexample, the data server 103, the web server 105, the servers 206, thevirtualization server 301, the zones 401-402, or other computingdevices. The cloud service 503 may be, for example, a public cloud thatis open for public use. The cloud service 503 may include aconfiguration service 513, a refresh service 515, a resource manager 517(including one or more resources 519A-N), and a shared cache 521.

The components of the cloud service 503 may be implemented on one serveror on multiple servers. For example, the components may be implementedon a server or a server cluster in a central datacenter. Additionally oralternatively, the components may be implemented on different serverslocated in different geographical regions. Additionally oralternatively, the configuration service 513 may be implemented on aserver in a central datacenter located in one geographical region, andthe resource manager 517 (including the resources 519A-N) may beimplemented in multiple datacenters located in different geographicalregions. The refresh service 515 and the shared cache 521 may beimplemented in each of the different geographical regions, closer toeach instance of the resource manager 517.

The internal cloud 505 may comprise processes running on, for example,the data server 103, the web server 105, the servers 206, thevirtualization server 301, the zones 401-402, or other computingdevices. The internal cloud 505 may be, for example, a private cloudthat is operated for one or more organizations. The internal cloud 505may be, for example, located on the organization premises, closer to endusers.

The internal cloud 505 may comprise a cloud connector 523 and internalresources 525. The cloud connector 523 may allow communications betweenthe cloud service 503 and the internal resources 525. The internalresources 525 may comprise, for example, documents, files, applications,desktops, data (e.g., private data), etc. The cloud service 503, such asvia the resources 519A-N, may access the internal resources 525 throughthe cloud connector 523.

The system may provide one or more of the resources 519A-N as a serviceto individual users. An individual user may be, for example, a naturalperson or a legal entity. Additionally or alternatively, the system mayprovide the resources 519A-N as a service to user groups. A user groupmay include a number of users. A user group may be, for example, anorganization (e.g., a business organization, a government organization,etc.), or a portion of the organization. A user group may be, forexample, a customer of the cloud service 503.

A user group may control, use, or manage a number of resources from theresources 519A-N. An administrator of the user group (or other personsor entities associated with the user group) may manage the user group'sresources. For example, the administrator may authorize a user in theuser group to access the user group's resources. The administrator mayassociate a resource of the user group's resources with the user (e.g.,allowing the user to access the resource by entering a username andpassword).

The administrator may manage the user group's resources through theclient agent 507. The client agent 507 may comprise, for example, a webbrowser, a mobile application, a thin client, a terminal emulator, etc.The client agent 507 may communicate with the cloud service 503. Theclient agent 507 may provide a user interface. Through the userinterface, the administrator may manage the user group's resources. Forexample, the administrator may monitor the running status of the usergroup's resources (e.g., monitor RAM usage rates, disk drive usagerates, etc.).

The resources 519A-N may include, for example, virtual machines (e.g.,the virtual machines 332), servers (e.g., the host servers 403), storage(e.g., the storage resources 404), network (e.g., the network resources405), databases, web servers, emails, virtual desktops, games,applications, or other resources.

A user may access a resource of the resources 519A-N through the useragent 509. The user agent 509 may comprise, for example, a web browser,a mobile application, a thin client, a terminal emulator, etc. The useragent 509 may be used to access one or more of the resources 519A-N. Theuser agent 509 may provide a user interface. Through the user interface,the user may use the resource (e.g., issue commands to the resource).For example, the user may start a virtual machine, launch anapplication, or send an email through the user interface.

The resource manager 517 may comprise, for example, a hypervisor (e.g.,the hypervisor 302), StoreFront as a Service (SFaaS), or other processesthat may control the resources 519A-N. The resource manager 517 mayassign hardware, software, network, or peripheral devices to a resourceaccording to configuration data for the resource. The resource manager517 may configure the resources 519A-N to be same or different accordingto their respective same or different configuration data. Additionallyor alternatively, the resource manager 517 may comprise a workspacestore (e.g., an enterprise application store that may provide aninterface for users to access the resources 519A-N) powered by a clusterof servers. The cluster of servers may sit behind a load balancer. Theload balancer may receive, from the user agent 509, a request to accessa resource of the resources 519A-N. Based on load balancing algorithms,the load balancer may route the request to a server of the cluster ofservers. The server of the cluster of servers may receive the requestand initiate configuring the resource (e.g., according to theconfiguration data for the resource). Different requests to access theresources 519A-N may be routed to different servers of the cluster ofservers based on the load balancing algorithms.

The configuration data may comprise, for example, information thatspecifies the configuration of a resource. For example, theconfiguration data for a virtual machine may include the virtualmachine's guest operating system type and version, Central ProcessingUnit (CPU) capacity, Random Access Memory (RAM) size, disk drive,network adapter information, or other settings. Additionally oralternatively, the configuration data may specify whether a resourceassociated with a user or a user agent associated with a user is allowedto access all or a portion of the internal resources 525 or other cloudresources. The configuration data may specify the manners (e.g., securedor unsecured connection, connection bandwidth, communication protocol,etc.) in which the resource or the user agent may access the internalresources 525 or other cloud resources. Additionally or alternatively,the configuration data may specify the design (e.g., colors, symbols,input controls, navigational components, informational components, etc.)of the user interface provided by the user agent 509. The configurationdata may be other types of data (e.g., data used for or by theresources).

The configuration data for the resources 519A-N may be stored in theconfiguration service 513. For example, the configuration service 513may maintain a database storing the configuration data for the resources519A-N. The administrator of a user group may modify the configurationdata stored in the database (e.g., through the client agent 507connected to the configuration service 513). The database may compriseany type of database systems (e.g., ORACLE Database, MySQL, MICROSOFTSQL Server, IBM DB2, etc.). The following shows an example databasetable storing configuration data.

User Group Configuration Data Group A RAM size 2 GB, disk 10 GB, guestoperating system Windows Group B RAM size 1 GB, disk 20 GB, guestoperating system Linux Group C RAM size 1 GB, disk 20 GB, guestoperating system Macintosh

In the table, the user groups may be identified by group identifiers(e.g., GroupA, GroupB, GroupC, etc.). Each user group may havecorresponding configuration data. The configuration data for a usergroup may be used to configure the resources of the user group. Forexample, a resource of the user group GroupA may be configured accordingto the configuration data “RAM size 2 GB, disk 10 GB, guest operatingsystem Windows.”

A user group may be divided into several subgroups, and each subgroupmay have its own configuration data, which may be same as or differentfrom the configuration data for another subgroup. The configuration datafor a subgroup may be used to configure the resources associated withthe subgroup. Additionally or alternatively, each resource of theresources of a user group may have its own specific configuration data.The database may store records of resource identifiers and correspondingconfiguration data. The resource identifier may identify a specificresource. The corresponding configuration data may be used to configurethat specific resource.

The configuration data stored in the configuration service 513 may beused by or for the resources 519A-N. For example, when a user requeststo access a resource, the resource manager 517 may send, to theconfiguration service 513, a request to obtain configuration data forthe resource. The request may include the group identifier of the user.The configuration service 513 may search the configuration data databaseto identify the configuration data corresponding to the groupidentifier. The configuration service 513 may send the configurationdata to the resource manager 517. The resource manager 517 may configurethe resource according to the received configuration data.

When the number of requests to obtain configuration data stored in theconfiguration service 513 becomes large (e.g., millions of requests),there might be a scalability challenge for the configuration service513. For example, the configuration service 513 might not be able to beeconomically configured to process the large number of requests toobtain configuration data.

Storing configuration data in the resources 519A-N may help alleviatethe scalability challenge for the configuration service 513. Forexample, a resource may be assigned storage by the resource manager 517.The storage may be local to the resource. The storage may be, forexample, a cache, memory, disk, virtual storage, or other types ofstorage. Configuration data for the resource may be stored in theresource's local storage, and may be read and used by the resourcemanager 517 to configure the resource.

The configuration data stored in the resources 519A-N may become out ofdate, or may become inconsistent among the resources 519A-N, if theresource manager 517 does not periodically query the configurationservice 513 to get up-to-date configuration data stored therein, andupdate the configuration data stored in the resources 519A-N. Forexample, the configuration data stored in a resource may be copied fromthe configuration service 513 when the resource was initially set up. Atsome later time, the configuration data may be needed again forconfiguring the resource. In the interim, the administrator may changethe configuration data for the resource, and that change may be made tothe configuration data stored in the configuration service 513. If theresource manager 517 does not query the configuration service 513 (e.g.,periodically), the configuration data stored in the resource may becomedifferent from the up-to-date configuration data stored in theconfiguration service 513.

The shared cache 521 may help alleviate the scalability challenge forthe configuration service 513, and help keep the configuration datastored in the resources up to date. The shared cache 521 may comprise,for example, a cloud database, or a high availability database. Forexample, the shared cache 521 may comprise an in-memory database thatprimarily relies on main memory (e.g., RAM), as opposed to disk storage,for data storage. Additionally or alternatively, the shared cache 521may be a REDIS database.

The configuration data for the resources 519A-N may be stored in theshared cache 521. For example, when a user requests access to aresource, the resource manager 517 may send a request to the sharedcache 521 to obtain the configuration data stored in the shared cache521. The shared cache 521 may maintain a database table similar to thedatabase table in the configuration service 513. For example, thedatabase table in the shared cache 521 may include data records of groupidentifiers and corresponding configuration data. The shared cache 521may use a group identifier as the key to search for the correspondingconfiguration data. Additionally or alternatively, the data records mayinclude subgroup identifiers and corresponding configuration data. Theshared cache 521 may identify configuration data based on searching asubgroup identifier. Additionally or alternatively, the data records mayinclude resource identifiers and corresponding configuration data. Theshared cache 521 may identify configuration data based on searching aresource identifier.

The configuration data stored in the shared cache may expire after anexpiration period (e.g., 5 minutes). The refresh service 515 may refreshthe expiration period of the data to keep it stored in the shared cache521 for a longer period of time. The refresh service 515 may update theconfiguration data stored in the shared cache 521. For example, therefresh service 515 may periodically check whether an administratorchanged the configuration data, and may update the configuration datastored in the shared cache 521 according to the changed configurationdata. Additionally or alternatively, when an administrator changes theconfiguration data stored in the configuration service 513, theconfiguration service 513 may notify the refresh service 515 of thechange. The refresh service 515 may receive the notification and proceedto update the configuration data stored in the shared cache 521.

If the shared cache 521 comprises an in-memory, high availabilitydatabase, the shared cache 521 may be more expensive or energy consumingthan other types of caches. It may be advantageous to determine the timewhen using the shared cache 521 may be preferred, such as when thenumber of requests to access the resources 519A-N or the number ofrequests to obtain configuration data is large. The refresh service 515may determine, based on information indicating the number of user accessevents, an operation mode. Based on the operation mode, the system maydetermine whether to use the configuration service 513 or the sharedcache 521 as the source to obtain configuration data. Methods forcaching data using the shared cache 521 are further discussed inconnection with FIGS. 6-8.

Requests to obtain data (e.g., the requests to obtain configuration datasent by the resource manager 517 to the configuration service 513, or tothe shared cache 521) may involve communicating data identifiers,instead of the data itself. The data identifiers may uniquely identifythe data, but may have a smaller file size than the data. This may helpreduce network traffic. The actual data might not be sent when acomparison of two data identifiers shows that two instances of the dataassociated with the two data identifiers are same.

FIG. 6 is a flowchart showing an example method for caching data using ashared cache. The method may be performed by, for example, the systemdiscussed in connection with FIG. 5. The method is discussed below andin FIG. 6 for configuration data. However, the method may be applicableto any types of data (e.g., data used for or by the resources).

In step 601, the user agent 509 may send, to the resource manager 517, arequest to access a resource of the resources 519A-N. A user of theremote computing device 501B may input, via the user agent 509, acommand to access the resource. For example, the user may enter in a webbrowser a Uniform Resource Locator (URL) that points to the cloudservice 503, and the web browser may show a webpage including a numberof icons. The user may select, via an input device (e.g., a touchscreen, keyboard, mouse, gesture, etc.) of the remote computing device501B, an icon for the resource. The user agent 509 implemented on theremote computing device 501B may initiate communication with theresource manager 517.

The resource manager 517 may receive the request to access the resourcefrom the user agent 509. The resource manager 517 may initiate processesto configure the resource, such as obtaining the configuration data forthe resource. In step 603, the resource manager 517 may determine thegroup identifier of the user (e.g., based on the user's request toaccess the resource). For example, the URL that the user entered in theweb browser that links to the cloud service 503 may indicate the groupidentifier of the user (e.g., a URL “groupA.cloudservice.com” indicatesthe group identifier is “groupA”). The group identifier included in theURL may be included in the request to access the resource.

Additionally or alternatively, the resource manager 517 may determinethe identity of the user (e.g., based on the user's request to accessthe resource). For example, the user may enter, in a web browser, a URLthat links to the cloud service 503. The webpage associated with the URLmay prompt the user to enter his or her username and password toauthenticate himself or herself. The username and password may beincluded in the request to access the resource. The resource manager 517may determine the user's identity based on the username and password.The resource manager 517 may identify the resource associated with theuser based on the user's identity.

In step 603, the resource manager 517 may also determine a configurationdata identifier for the configuration data stored in the resource. Theconfiguration data identifier may be used to determine whether twoinstances of the configuration data are same. The resource manager 517may retrieve the configuration data stored in the resource, and generatethe configuration data identifier based on the retrieved configurationdata.

The configuration data identifier may be, for example, a successivecombination of all or a portion of the configuration data. For example,if the configuration data includes data fields RAM size, disk size, andguest operating system, and the values of those data fields arerespectively 2 GB, 10 GB, and Operating_System_1, the configuration dataidentifier may be 2 GB 10 GB Operating_System_1.

Additionally or alternatively, the configuration data identifier may begenerated by a fingerprinting algorithm. The fingerprinting algorithmmay map a large set of data to a shorter bit string (e.g., thefingerprint) that uniquely identifies the original set of data. Theinput of the fingerprinting algorithm may comprise the configurationdata or a portion thereof. The output of the fingerprinting algorithmmay comprise the configuration data identifier.

Additionally or alternatively, the configuration data identifier may begenerated by a hash function (e.g., hashing the configuration data togenerate the configuration data identifier). Additionally oralternatively, the configuration data identifier may comprise an entitytag (ETag), and may be generated by an ETag generation algorithm (e.g.,a collision-resistant hash function).

Additionally or alternatively, the configuration data identifier may begenerated based on a last modification timestamp of the configurationdata. For example, when an administrator modifies the configuration datain the configuration service 513, the time of making the modification(e.g., a timestamp) may be recorded (e.g., stored in connection with theconfiguration data). The timestamp may indicate a version of theconfiguration data. Additionally or alternatively, the configurationdata identifier may be generated by applying a fingerprinting algorithmor hash function to the last modification timestamp.

As the configuration data identifier may be transmitted via the network,using the fingerprinting or hashing algorithms to generate theconfiguration data identifier may help reduce traffic, and savebandwidth of the network.

In step 605, the resource manager 517 may send, to the refresh service515, a message indicating an access event. The message indicating theaccess event may indicate, to the refresh service 515, that a user isrequesting to access the resource and the configuration data for theresource is desired. The access event message may include the groupidentifier of the user and/or a timestamp of sending the message.

In step 607, the refresh service 515 may receive the message and mayrecord the access event. The message may be used by the refresh service515 to determine an operation mode (e.g., high load operation mode orlow load operation mode). The operation mode may indicate whether theconfiguration service 513 or the shared cache 521 is to be the source toobtain configuration data. The refresh service 515 may aggregate accessevents generated as a result of different user requests to accessresources. The refresh service 515 may determine the operation modebased on the aggregated access events.

A user group specific operation mode may be determined. The refreshservice 515 may aggregate access events associated with a particularuser group, and determine the quantity of access events associated withthe user group generated within a time window (e.g., 10 minutes). Forexample, if a user requesting to access a resource is a member of usergroup A, the access event generated as a result of the user's request toaccess the resource may be considered by the refresh service 515 todetermine the operation mode for user group A. If another userrequesting access to a resource is a member of user group B, the accessevent generated as a result of the other user's request to access theresource might not be considered by the refresh service 515 to determinethe operation mode for user group A.

If the number of access events associated with the user group within thetime window exceeds a threshold, the refresh service 515 may set theoperation mode for the user group to be the high load operation mode.Otherwise, the refresh service 515 may set the operation mode for theuser group to be the low load operation mode. The threshold may bedetermined based on the capacity of the configuration service 513 toprocess requests to obtain configuration data. For example, if theconfiguration service 513 may handle N requests within the time window,and the cloud service 503 has M user groups, the threshold may be set tobe N/M (N divided by M). Additionally or alternatively, if theconfiguration service 513 may handle N requests within the time window,the cloud service 503 has M users, and the particular user groupincludes L users, the threshold may be set to be N*L/M (N multiply Ldivided by M).

Additionally or alternatively, the refresh service 515 may determine theoperation mode for a user group based on business hours associated withthe user group. For example, the refresh service 515 may determine thatthe operation mode is the high load operation mode during standardbusiness hours in the region in which the user group is located (e.g.,the user group's primary location). For example, if the user group is inthe United States and the standard business hours in the United Statesis 9 am to 5 pm, the system may determine that the operation mode forthe user group is the high load operation mode from 9 am to 5 pm.

Additionally or alternatively, the refresh service 515 may determine acommon operation mode for the user groups. The refresh service 515 mayaggregate received access events associated with the user groups, anddetermine the quantity of access events generated within a time window(e.g., 10 minutes). If the number of access events within the timewindow exceeds a threshold, the refresh service 515 may set the commonoperation mode to be the high load operation mode. Otherwise, therefresh service 515 may set the common operation mode to be the low loadoperation mode. The threshold may be determined based on the capacity ofthe configuration service 513. For example, if the configuration service513 is able to process 1 million requests to obtain configuration dataduring the time window, the threshold may be set as 1 million.

Historical data may be used to predict the time period when there may behigh volume of requests to obtain configuration data. For example, therefresh service 515 may consider access events recorded for the lastday, month, or year. If the historical data shows that the number ofaccess events from 10 am to 11 am on Monday exceeds a threshold, therefresh service 515 may determine that the operation mode during the 10am to 11 am time period on next Monday may be the high load operationmode.

The refresh service 515 may inform the configuration service 513, theresource manager 517, the shared cache 521, or other components, of thedetermined operation mode. For example, when the operation mode changesfrom one state to another state, the refresh service 515 may send amessage indicating the change of the operation mode.

The resource manager 517 may receive (e.g., from the refresh service515) the operation modes for one or more user groups. The resourcemanager 517 may determine the operation mode for the user's request toaccess the resource. For example, the operation mode for the request toaccess the resource may be the operation mode for the user group inwhich the user sending the request is a member.

Based on the operation mode for the user's request to access theresource, the method may proceed to two alternative sets of steps. Ifthe resource manager 517 determines 609 that the operation mode for theuser's request to access the resource comprises the low load operationmode, the method may proceed to step 613. In step 613, the resourcemanager 517 may send, to the configuration service 513, a request toobtain configuration data for the resource. The request may include thegroup identifier of the user. The configuration service 513 may receivethe request, and, based on the group identifier, find the correspondingconfiguration data for the resource. In step 615, the configurationservice 513 may send the found configuration data to the resourcemanager 517. The resource manager 517 may receive the configuration datafrom the configuration service 513. The resource manager 517 may replacethe configuration data stored in the resource with the receivedconfiguration data. The resource manager 517 may configure the resourcebased on the received configuration data.

Additionally or alternatively, the request to obtain configuration datasent by the resource manager 517 in step 613 may include theconfiguration data identifier for the configuration data stored in theresource. The configuration service 513 may generate a secondconfiguration data identifier based on the configuration data for theresource stored in the configuration service 513. The configurationservice 513 may compare the two configuration data identifiers. If theconfiguration service 513 determines that they are different, theconfiguration service 513 may send, to the resource manager 517, amessage indicating that the configuration data stored in the resource isout of date. The message may include the configuration data stored inthe configuration service 513. Otherwise, the configuration service 513may send, to the resource manager 517, a message indicating that theconfiguration data stored in the resource is up to date, and that theresource manager 517 may use the configuration data stored in theresource to configure the resource.

If the resource manager 517 determines 611 that the operation mode forthe user's request to access the resource comprises the high loadoperation mode, the method may proceed to step 617. In step 617, theresource manager 517 may send, to the shared cache 521, a request to getconfiguration data for the resource. The request may include the groupidentifier of the user. The shared cache 521 may receive the request. Instep 619, the shared cache 521 may determine, based on the groupidentifier, whether the corresponding configuration data for theresource is stored in the shared cache 521.

Based on whether the configuration data for the resource is stored inthe shared cache 521, the method may proceed to two alternative sets ofsteps. If the shared cache 521 determines 621 that it stores theconfiguration data for the resource, the method may proceed to step 625.In step 625, the shared cache 521 may send, to the resource manager 517,the configuration data for the resource stored in the shared cache 521.The resource manager 517 may receive the configuration data from theshared cache 521. The resource manager 517 may replace the configurationdata stored in the resource with the received configuration data. Theresource manager 517 may use the received configuration data toconfigure the resource.

Additionally or alternatively, the request to obtain configuration datasent by the resource manager 517 in step 617 may include theconfiguration data identifier for the configuration data stored in theresource. The shared cache 521 may generate a second configuration dataidentifier based on the configuration data for the resource stored inthe shared cache 521. The shared cache 521 may compare the twoconfiguration data identifiers. If the shared cache 521 determines thatthey are different, the configuration service 513 may send, to theresource manager 517, a message indicating that the configuration datastored in the resource is different (e.g., out of date). The message mayinclude the configuration data stored in the shared cache 521.Otherwise, the shared cache 521 may send, to the resource manager 517, amessage indicating that the configuration data stored in the resource isup to date, and that the resource manager 517 may use the configurationdata stored in the resource to configure the resource.

If the shared cache 521 determines 623 that it does not store theconfiguration data for the resource, the method may proceed to step 627.In step 627, the shared cache 521 may send, to the resource manager 517,a response indicating that the configuration data for the resource isnot stored in the shared cache 521. The resource manager 517 may receivethe response.

In step 629, the resource manager 517 may send, to the configurationservice 513, a request to obtain configuration data for the service. Theconfiguration service 513 may respond to the request in step 629 in amanner similar to step 613 described above. In step 631, theconfiguration service 513 may send the configuration data to theresource manager 517, in a manner similar to step 615 described above.As explained above, configuration data identifier(s) for theconfiguration data stored in the resource may be used to save bandwidthin the communication between the resource manager 517 and theconfiguration service 513 in steps 629, 631.

The resource manager 517 may receive the configuration data for theresource from the configuration service 513, and may configure theresource according to the received configuration data. The resourcemanager 517 may replace the configuration data stored in the resourcewith the received configuration data. In step 633, the resource manager517 may send, to the shared cache 521, a message to insert, to theshared cache 521, the configuration data the resource manager 517received from the configuration service 513 (e.g., in step 631).Additionally or alternatively, if the configuration service 513 in step631 indicates that the configuration data stored in the resource is upto date, the resource manager 517, in step 633, may send, to the sharedcache 521, a message to insert, to the shared cache 521, theconfiguration data stored in the resource.

The shared cache 521 may insert the received configuration data as a newrecord in its database table. If afterwards the shared cache 521receives a request to obtain configuration data for the same resource orfor a resource associated with the same user group, the shared cache 521may return the configuration data based on the new record.

Additionally or alternatively, when the operation mode for a user groupchanges from the low load operation mode to the high load operationmode, the system may identify, in the configuration service 513,configuration data associated with the user group, and insert theidentified configuration data to the shared cache 521.

In step 635, the shared cache 521 may send, to the resource manager 517,a response indicating that the configuration data has been inserted tothe shared cache 521. In step 637, the resource manager 517 may make theconfigured resource available to the user through the user agent 509.

FIG. 7 is a flowchart showing an example method for updating orrefreshing data stored in a shared cache. The method is discussed belowand in FIG. 7 for configuration data. However, the method may beapplicable to any types of data (e.g., data used for or by theresources). The method may be performed for each record of data storedin the shared cache 521.

Based on the operation mode for a user group, the method may proceed totwo alternative sets of steps. If the system determines 703 that theoperation mode for the user group is the low load operation mode, themethod might not perform any steps to update or refresh configurationdata for the user group stored in the shared cache 521. For example, ifconfiguration data for the user group is stored in the shared cache 521,and the operation mode for the user group comprises the low loadoperation mode, the system may allow the configuration data to expireafter the expiration period.

If the system determines 701 that the operation mode for a user group isthe high load operation mode, the method may proceed to step 705. Instep 705, the refresh service 515 may wake up to initiate processes tokeep the configuration data stored in the shared cache 521 during thehigh load operation mode, and to maintain the configuration data storedin the shared cache 521 up to date. The refresh service 515 may wake upperiodically. For example, the refresh service 515 may wake up after atime period that is the same as the expiration period of theconfiguration data. Additionally or alternatively, the refresh service515 may wake up after a time period that is different from theexpiration period of the configuration data.

In step 707, the refresh service 515 may send, to the shared cache 521,a request to get configuration data associated with the user group. Therequest may include the group identifier. The shared cache 521 mayreceive the request, and find the configuration data corresponding tothe group identifier. In step 709, the shared cache 521 may send, to therefresh service 515, a response indicating the configuration dataassociated with the user group. The refresh service 515 may receive theresponse, and may extract the configuration data from the response. Therefresh service 515 may generate a configuration data identifier basedon the extracted configuration data. Additionally or alternatively, toreduce the amount of data being transmitted, the refresh service 515 mayin step 707 send, to the shared cache 521, a request to obtain aconfiguration data identifier for configuration data associated with theuser group. After receiving the request, the shared cache 521 may findthe configuration data corresponding to the user group, and may generatea configuration data identifier based on the found configuration data.The shared cache 521 may send the generated configuration dataidentifier to the refresh service 515.

In step 711, the refresh service 515 may send, to the configurationservice 513, a request to obtain the configuration data for the usergroup stored in the configuration service 513. At some point in time,the administrator of the user group may modify, through the client agent507, the configuration data for the user group. The change may bereflected in the configuration data stored in the configuration service513, but not in the configuration data stored in the shared cache 521.

The request to obtain configuration data may include the groupidentifier of the user group, and the configuration data identifier thatthe refresh service 515 generated or received from the shared cache 521.The configuration service 513 may receive the request. The configurationservice 513 may search its database to find the configuration dataassociated with the group identifier. The configuration service 513 maygenerate a second configuration data identifier based on the foundconfiguration data. The configuration service 513 may compare thereceived configuration data identifier and the second configuration dataidentifier to see if they are different. If they are different, theconfiguration service 513 may determine that the configuration datastored in the configuration service 513 has been modified by theadministrator, and that the configuration data stored in the sharedcache 521 is out of date. Otherwise, the configuration service 513 maydetermine that the configuration data stored in the configurationservice 513 has not been modified by the administrator, and theconfiguration data stored in the shared cache 521 is up to date.

Based on whether the configuration data stored in the configurationservice 513 has been changed by the administrator, the method mayproceed to two alternative sets of steps. If the configuration service513 determines 713 that the configuration data stored therein has beenchanged, the method may proceed to step 717. In step 717, theconfiguration service 513 may send, to the refresh service 515, aresponse indicating that the configuration data stored in theconfiguration service 513 has been changed. The response may include theconfiguration data associated with the user group stored in theconfiguration service 513. The refresh service 515 may receive theresponse, and may extract the configuration data.

In step 719, the refresh service 515 may send, to the shared cache 521,a request to insert the extracted configuration data into the sharedcache 521. The shared cache 521 may receive the request and may insertthe configuration data as a new record in the shared cache 521. In step721, the shared cache 521 may send, to the configuration service 513, aresponse indicating that the configuration data has been inserted intothe shared cache 521.

If the configuration service 513 determines 715 that the configurationdata stored therein has not been changed, the method may proceed to step723. In step 723, the configuration service 513 may send, to the refreshservice 515, a response indicating that the configuration data stored inthe configuration service 513 has not been changed. The refresh service515 may receive the response.

In step 725, the refresh service 515 may send, to the shared cache 521,a request to refresh the expiration period for the configuration data.The shared cache 521 may receive the request, and may refresh theexpiration period for the configuration data. In step 727, the sharedcache 521 may send, to the refresh service 515, a response indicatingthat the expiration period for the configuration data has beenrefreshed.

FIG. 8 is a flowchart showing an example method for updating data storedin a shared cache based on data change events. The method is discussedbelow and in FIG. 8 for configuration data. However, the method may beapplicable to any types of data (e.g., data used for or by theresources).

In step 801, the client agent 507 may send, to the configuration service513, a request to change configuration data associated with a usergroup. For example, an administrator of a user group may change, throughthe client agent 507, the configuration data for the user group storedin the configuration service 513.

The configuration service 513 may receive the request, and may changethe configuration data. In step 803, the configuration service 513 maysend, to the client agent 507, a response indicating that theconfiguration data for the user group in the configuration service 513has been changed.

In step 805, the configuration service 513 may send, to the refreshservice 515, a message of a configuration data change event. The messagemay indicate that the configuration data for the user group was changed.The message may include the group identifier of the user group.

In step 807, the refresh service 515 may determine the operation modefor the user group. If the operation mode for the user group comprises ahigh load operation mode, the refresh service 515 may proceed to step809. If the operation mode for the user group comprises a low loadoperation mode, the refresh service 515 may stop at step 807, and mightnot proceed to step 809.

In step 809, the refresh service 515 may send, to the configurationservice 513, a request to obtain the configuration data associated withthe user group. In step 811, the configuration service 513 may send, tothe refresh service 515, a response indicating the requestedconfiguration data.

The refresh service 515 may receive the response, and may extract theconfiguration data. In step 813, the refresh service 515 may send, tothe shared cache 521, a request to insert the extracted configurationdata into the shared cache 521. The shared cache 521 may receive therequest, extract the configuration data, and insert the configurationdata into the shared cache 521 as a new record. If configuration dataassociated with the user group is already stored in the shared cache 521when the shared cache 521 receives the insert request, the shared cache521 may instead update the configuration data stored in the shared cache521 with the extracted configuration data. In step 815, the shared cache521 may send, to the refresh service 515, a response indicating that theconfiguration data has been inserted into the shared cache 521.

Although the subject matter has been described in language specific tostructural features and/or methodological acts, it is to be understoodthat the subject matter defined in the appended claims is notnecessarily limited to the specific features or acts described above.Rather, the specific features and acts described above are described asexample implementations of the following claims.

What is claimed is:
 1. A method comprising: receiving, from a userdevice and by a computing device, a request to access a resource;determining an identifier associated with the resource and a dataidentifier indicating first data associated with the resource, whereinthe first data is stored in a local storage of the resource; based on aload of a configuration service for the resource, sending, to a sharedcache for the resource, a request to determine whether second dataassociated with the resource is stored in the shared cache, wherein therequest to determine whether the second data associated with theresource is stored in the shared cache comprises the identifierassociated with the resource and the data identifier; receiving, fromthe shared cache, an indication of whether the second data associatedwith the resource is stored in the shared cache, wherein whether thesecond data associated with the resource is stored in the shared cacheis determined by searching the second data corresponding to theidentifier associated with the resource; determining, based on theindication of whether the second data associated with the resource isstored in the shared cache, whether to send, to the configurationservice, a request to obtain third data associated with the resource;and receiving an indication of whether the first data corresponds to thesecond data or the third data, wherein whether the first datacorresponds to the second data or the third data is determined bycomparing the data identifier indicating the first data with a dataidentifier indicating the second data or with a data identifierindicating the third data.
 2. The method of claim 1, further comprising:determining, based on the data identifier indicating the first data andthe data identifier indicating the second data, whether the second datais different from the first data; and after determining that the seconddata is different from the first data, replacing the first data with thesecond data.
 3. The method of claim 1, further comprising: receiving anindication that the second data corresponds to the first data; andconfiguring the resource based on the first data stored in the localstorage of the resource.
 4. The method of claim 1, wherein the seconddata expires after an expiration period, the method further comprisingafter determining that the load of the configuration service satisfies athreshold, refreshing the expiration period of the second data.
 5. Themethod of claim 1, further comprising: after determining that the seconddata is not stored in the shared cache, sending, to the configurationservice, a request to obtain the third data; receiving, from theconfiguration service, the third data; and inserting, to the sharedcache, the third data.
 6. The method of claim 1, further comprising:receiving a second request to access a second resource; and afterdetermining that the load of the configuration service does not satisfya threshold, sending, to the configuration service, a request to obtainfourth data associated with the second resource.
 7. The method of claim1, further comprising determining, based on business hours of a businessassociated with a user of the user device, the load of the configurationservice.
 8. The method of claim 1, further comprising: receiving, withina period of time, a plurality of requests to access a plurality ofresources, resources; and determining, based on a number of theplurality of requests the load of the configuration service.
 9. Themethod of claim 1, wherein the shared cache comprises an in-memorydatabase.
 10. The method of claim 1, wherein the data identifierindicating the first data comprises a fingerprint of the first data. 11.The method of claim 1, wherein the first data comprises a first versionof configuration data for the resource, the second data comprises asecond version of the configuration data for the resource, and the thirddata comprises a third version of the configuration data for theresource.
 12. The method of claim 1, further comprising: receiving, fromthe shared cache, an indication that the first data corresponds to thesecond data, wherein the shared cache is configured to determine thatthe first data corresponds to the second data based on: retrieving thesecond data corresponding to the identifier associated with theresource; generating, based on the second data, the data identifierindicating the second data; and determining that the data identifierindicating the first data corresponds to the data identifier indicatingthe second data.
 13. A computing device comprising: one or moreprocessors; and memory storing instructions that, when executed by theone or more processors, cause the computing device to: receive, from auser device, a request to access a resource; determine an identifierassociated with the resource and a data identifier indicating first dataassociated with the resource, wherein the first data is stored in alocal storage of the resource; based on a load of a configurationservice for the resource, send, to a shared cache for the resource, arequest to determine whether second data associated with the resource isstored in the shared cache, wherein the request to determine whether thesecond data associated with the resource is stored in the shared cachecomprises the identifier associated with the resource and the dataidentifier; receive, from the shared cache, an indication of whether thesecond data associated with the resource is stored in the shared cache,wherein whether the second data associated with the resource is storedin the shared cache is determined by searching the second datacorresponding to the identifier associated with the resource; determine,based on the indication of whether the second data associated with theresource is stored in the shared cache, whether to send, to theconfiguration service, a request to obtain third data associated withthe resource; and receive an indication of whether the first datacorresponds to the second data or the third data, wherein whether thefirst data corresponds to the second data or the third data isdetermined by comparing the data identifier indicating the first datawith a data identifier indicating the second data or with a dataidentifier indicating the third data.
 14. The computing device of claim13, wherein the instructions, when executed by the one or moreprocessors, further cause the computing device to: determine, based onthe data identifier indicating the first data and the data identifierindicating the second data, whether the second data is different fromthe first data; and after determining that the second data is differentfrom the first data, replace the first data with the second data. 15.The computing device of claim 13, wherein the instructions, whenexecuted by the one or more processors, further cause the computingdevice to: receive an indication that the second data corresponds to thefirst data; and configure the resource based on the first data stored inthe local storage of the resource.
 16. The computing device of claim 13,wherein the second data expires after an expiration period, and whereinthe instructions, when executed by the one or more processors, furthercause the computing device to, after determining that the load of theconfiguration service satisfies a threshold, refresh the expirationperiod of the second data.
 17. The computing device of claim 13, whereinthe instructions, when executed by the one or more processors, furthercause the computing device to: after determining that the second data isnot stored in the shared cache, send, to the configuration service, arequest to obtain the third data; receive, from the configurationservice, the third data; and insert, to the shared cache, the thirddata.
 18. One or more non-transitory computer readable media storingcomputer readable instructions that, when executed, cause a computingdevice to: receive, from a user device, a request to access a resource;determine an identifier associated with the resource and a dataidentifier indicating first data associated with the resource, whereinthe first data is stored in a local storage of the resource; based on aload of a configuration service for the resource, send, to a sharedcache for the resource, a request to determine whether second dataassociated with the resource is stored in the shared cache, wherein therequest to determine whether the second data associated with theresource is stored in the shared cache comprises the identifierassociated with the resource and the data identifier; receive, from theshared cache, an indication of whether the second data associated withthe resource is stored in the shared cache, wherein whether the seconddata associated with the resource is stored in the shared cache isdetermined by searching the second data corresponding to the identifierassociated with the resource; determine, based on the indication ofwhether the second data associated with the resource is stored in theshared cache, whether to send, to the configuration service, a requestto obtain third data associated with the resource; and receive anindication of whether the first data corresponds to the second data orthe third data, wherein whether the first data corresponds to the seconddata or the third data is determined by comparing the data identifierindicating the first data with a data identifier indicating the seconddata or with a data identifier indicating the third data.
 19. Thenon-transitory computer readable media of claim 18, wherein the computerreadable instructions, when executed, further cause the computing deviceto: determine, based on the data identifier indicating the first dataand the data identifier indicating the second data, whether the seconddata is different from the first data; and after determining that thesecond data is different from the first data, replace the first datawith the second data.
 20. The non-transitory computer readable media ofclaim 18, wherein the computer readable instructions, when executed,further cause the computing device to: after determining that the seconddata is not stored in the shared cache, send, to the configurationservice, a request to obtain the third data; receive, from theconfiguration service, the third data; and insert, to the shared cache,the third data.